Malicious Code Injection in dictanovaasr Package
Summary
MAL-2026-18139: Malicious code in dictanovaasr (PyPI). Affects dictanovaasr versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dictanovaasr package, available on PyPI, is designed for voice synthesis applications. It allows users to integrate voice recognition and synthesis functionalities into their Python projects. However, this package has been identified as part of a malicious campaign that enables the execution of remote scripts, posing significant security risks to users.
Vulnerability Detail
The vulnerability in the dictanovaasr package stems from its ability to download and execute code from a remote URL. This behavior is indicative of a coordinated campaign to distribute malicious software, potentially leading to unauthorized access to sensitive information or system compromise. The specific version affected is 0.1.0, which has been confirmed to contain this malicious functionality.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall dictanovaasrIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the dictanovaasr package until a secure version is released. Additionally, consider implementing network security measures to block unauthorized script execution from unknown sources.
Conclusion
The dictanovaasr package has been identified as part of a malicious campaign that can execute remote scripts, posing serious security threats. Users are advised to uninstall the affected version and remain vigilant for updates. Utilizing tools like Vulert can help in monitoring and mitigating such vulnerabilities.
See every vulnerability recorded for dictanovaasr →
FAQ
dictanovaasr is a Python package designed for voice synthesis applications, allowing integration of voice recognition and synthesis functionalities.
The vulnerability allows the package to download and execute malicious scripts from remote URLs, posing a significant security risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If you have installed dictanovaasr, it is recommended to uninstall it immediately and monitor for any updates or patches from the developers.
Yes, always verify the source of the package, keep your dependencies updated, and utilize tools like Vulert to monitor for vulnerabilities.
